1. Field of the Invention
The present invention relates to the field of network security, and, more particularly, a method and system for performing comprehensive network fault analysis by cross-correlating network security information and network management information.
2. Description of the Related Art
Computer networks and related systems produce a tremendous amount of information related to network security. Analysis of this security information as well as information related to network management is needed for network security purposes. Originally, networks had few automated functions. A human operator was generally responsible for providing network security. As networks became more complex, it became more difficult for an operator to effectively provide security. Therefore, it has long been desired to develop tools to aid operators and administrators in securing the network. Generally, tools of this nature only focused on a single domain, for example, either network management or network security. Because many tools only focus on information provided within the realm of one domain, they may supply information which inaccurately or incompletely describes the state of the network as a whole. Although generally related to relatively different domains, information from the network management domain may impact the analysis of information in the network security domain and vice versa. Thus, there is a need to cross-correlate information between tools monitoring the network security and network management domains for a more accurate and comprehensive understanding of overall network status. But because conventional methods, in their respective domains, are not necessarily compatible with each other, there is also a need to develop techniques for correlating information in the network security domain that are compatible with the conventional methods already developed for network management.
In addition, network management tools have typically advanced at a more rapid pace than security tools. There is a wide variety of conventional software products available that aid an operator in managing a network. For example, a system might have network management software that would alert the operator when a component was malfunctioning. Some other conventional methods use more sophisticated fault analysis tools such as event correlation and root cause analysis tools (for example, rule-based reasoning, case-based reasoning, generic models, probability networks, model-based reasoning) to aid in automating management of a network. However, many existing methods have not proven to be an adequate solution for modern systems because they lack extensibility, have performance difficulties in some systems, may have large storage requirements, need to be constantly updated/configured, and are unable to compare information across domains.
One fault analysis solution that has applied event correlation to the network management domain is described in U.S. Pat. Nos. 5,528,516, No. 5,661,668, and No. 6,249,755. These patents disclose a method and system for fault analysis using event correlation with a causality matrix to solve the problem of fault isolation. Those patents describe using an object-oriented model of a managed network domain to develop a separate network topology for the physical system that relates the managed network devices to each other. In the method described in those patents, symptoms, problems, and their propagation through the system can be described for individual device types, independent of their configuration in a particular environment. One object-oriented model that has been applied to network management is the Common Information Model (CIM) from the DMTF (Distributed Management Task Force) industry consortium, which describes the generic physical and logical devices and their components in an enterprise network, and their relationships to each other. However, CIM does not suggest using the model for network security events.
While many conventional solutions have been developed in the domain of network management, comparable solutions have not been developed for the domain of network security. Network security tools, such as encryption, firewalls, and intrusion detection systems, usually address specific security issues. Few conventional methods exist for correlating information between these security tools, and those that currently exist are generally married to the proprietary solutions of a particular vendor. Typical correlation methods collect messages such as those generated using Simple Network Management Protocol (“SNMP”) from the various tools and display them on a common user interface. These conventional methods rely on the operator to correlate much of the information manually to determine its significance, and may not be sophisticated enough for the complexity and volume of information in some modern systems. One example of security information messages between network security tools is the Internet Engineering Task Force Intrusion Detection Message Exchange Format (“IDMEF”), which attempts to define a common format for intrusion messages among heterogeneous vendors. The IDMEF standard does not suggest, however, an object model for representing network security events that would allow correlation of network security events. Thus, there is a need for better and more automated correlation of information in the domain of network security.
Because the domains of network management and network security may be closely related, information from the security domain may affect the network management analysis and vice versa. Because of the limited view provided by existing fault analysis tools, fault recovery in either domain may be based on incomplete or inaccurate information. The severity of a security event can only be evaluated in the context of the network in which it occurs. For example, something as trivial as a DNS zone transfer may be perceived as a threat in the security domain by a simple security tool. Such a transfer may be acceptable, expected behavior, if it takes place within the protected network, between primary and secondary DNS servers. Alternately, it may simply be a mis-configured DNS server, in which case this observed “security symptom” is of more use to the network managers who must reconfigure the server. Finally, it may indeed be a security threat, if the zone transfer information is leaving the protected network enclave, and being collected by a malicious agent on the Internet, for example. Thus, there is a need to develop a fault analysis tool to correlate information in the network security domain that is compatible with an advanced network management method to allow for cross-correlation of information between the network management domain and the network security domain to provide a more comprehensive analysis of a system.